5 ms·
Usually it's done when redesigning/recompiling the target function is not possible. Game modding, restartless updates, instrumentation, etc.
by reubenmorais 11y ago
Usually it's done when redesigning/recompiling the target function is not possible. Game modding, restartless updates, instrumentation, etc.
- csl 11y agoBut that would only be possible from the same process space, right? So only applicable for plugins etc.? What I'd like to see is hotpatching the function for another process, but I guess that's very hard to do with ASLR. Probably doable with some tricks, though. Edit: Come to think of it, gdb is able to attach to a running process w/o debug symbols and find function addresses. So in other words, I just need to dig into and grok the gdb source.
- chatmasta 11y agoIf you are able to recompile the program, you can disable ASLR. For example on iOS it just requires a change to the MACH-O header of the binary. [0] But I doubt you could disable ASLR of a running process, for somewhat obvious reasons... [0] https://github.com/peterfillmore/removePIE https://github.com/peterfillmore/removePIE
- dreamlayers 11y agoYou can similarly disable ASLR via the header in Windows, though there are ways to override that. ASLR shouldn't be a big problem though. Only the base address of code in each file (executable or library) is changed, and you can easily find it. Functions within one file are not shuffled around. ASLR only exists to stop you from hard-coding function addresses, to make exploits harder.
- dreamlayers 11y agoThe program being modified doesn't need some feature for loading your code as a plugin. You can instead use https://en.wikipedia.org/wiki/DLL_injection https://en.wikipedia.org/wiki/DLL_injection
- kazinator 11y agoIf you want restartless updates, then you plan for it and modularize the software with dynamically loadable modules (think shared library "plugins" or kernel modules).
- reubenmorais 11y agoYou're talking about when you own the source and therefore can redesign/recompile it. I began my comment explicitly ruling those cases out. Let's say you're Red Hat, and want to release a super critical security fix for some package, but you absolutely cannot restart the affected process. This technique allows you to write some code that redirects functions to fixed versions, patching the process while it runs.
- dkopi 11y agoIf you don't control the code and can't recompile it, you won't be able to add the ms_hook_prologue function property
- kazinator 11y agoIf you don't control the code and are modifying it to do an in-service upgrade of a running binary, then this is a special situation: you're shooting a 2016 re-make of MacGyver targeted at a geek/programmer audience. If you're Red Hat and you do have the source, but the service cannot be stopped, and yet it must be upgraded, yet you didn't plan this into the software (and yet you didn't write in it in Lisp which could save your ass here) then you're plain stupid. If you're stupid, you're not going to pull off this highly technical, intricate hack, that is looming with pitfalls.
- reubenmorais 11y agoI mentioned this in another comment, but you don't need the ms_hook_prologue attribute, it's just helpful.
- dkopi 11y ago
- kazinator 11y agoIf you want restartless updates, then you plan for it and modularize the software with dynamically loadable modules (similar to shared libraries or kernel modules).
- deathanatos 11y agoExcept the technique presented requires recompiling the target function, doesn't it? (To add all those GCC attributes, and to add the `lea` instruction.)
- reubenmorais 11y agoThe specific technique shown here requires it, but you can also do it generically by overwriting the first 8 bytes of the function and then restoring it later if you want to undo the hook.